How can you avoid clock exploits in Android games?

Question

I need to measure a period of time that can last up to a few hours. I'm assuming the normal way to do this would be something like:

Date date = new Date();
...wait some time...
(new Date()).getTime() - date.getTime())

But could a user change Android's clock back an hour to cheat the game and make the timespan shorter? Would reading time from an online source be the best solution?

Answer 1

new Date() uses System.currentTimeMillis() which depends on the OS clock - and is subject to change when the user changes the system date and time.

You should use System.nanoTime(), which has following properties:

/**
 * Returns the current value of the most precise available system
 * timer, in nanoseconds.
 *
 * <p>This method can only be used to measure elapsed time and is
 * not related to any other notion of system or wall-clock time.
 * The value returned represents nanoseconds since some fixed but
 * arbitrary time (perhaps in the future, so values may be
 * negative).  This method provides nanosecond precision, but not
 * necessarily nanosecond accuracy. No guarantees are made about
 * how frequently values change. Differences in successive calls
 * that span greater than approximately 292 years (2<sup>63</sup>
 * nanoseconds) will not accurately compute elapsed time due to
 * numerical overflow.
 *
 * <p> For example, to measure how long some code takes to execute:
 * <pre>
 *   long startTime = System.nanoTime();
 *   // ... the code being measured ...
 *   long estimatedTime = System.nanoTime() - startTime;
 * </pre>
 * 
 * @return The current value of the system timer, in nanoseconds.
 * @since 1.5
 */
public static native long nanoTime();

This can not be manipulated by just changing the system date.